X509Certificate2 崩溃 IIS答案

【问题标题】：X509Certificate2 crash IISX509Certificate2 崩溃 IIS
【发布时间】：2015-11-07 19:38:54
【问题描述】：

这是破坏 IIS 的代码，经过研究，我发现了以下帖子 X509Certificate2 makes IIS crash 解决了我的问题

        var cert = new X509Certificate2();
        cert.Import(Resources.wildcard, "xxx", X509KeyStorageFlags.Exportable);

固定代码

        var cert = new X509Certificate2();
        cert.Import(Resources.wildcard, "xxx", X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.Exportable);

但是现在这会导致我的签名引发以下异常

n exception of type 'System.Security.Cryptography.CryptographicException' occurred in mscorlib.dll but was not handled in user code
Additional information: Invalid provider type specified.

我的代码

public class RsaSha1
{
    private readonly X509Certificate2 _certificate;

    public RsaSha1(X509Certificate2 certificate)
    {
        _certificate = certificate;
    }

    public string Sign(string signatureBaseString)
    {
        return SignCore(signatureBaseString);
    }

    string SignCore(string baseString)
    {
        using (var hash = Hash(baseString))
        {
            return Base64Encode(Sign(hash));
        }
    }

    private static string Base64Encode(byte[] signature)
    {
        return Convert.ToBase64String(signature);
    }


    private byte[] Sign(SHA1CryptoServiceProvider hash)
    {
        var formatter = new RSAPKCS1SignatureFormatter(_certificate.PrivateKey).
            Tap(it => it.SetHashAlgorithm("MD5"));
   //The line above throws the Exception if X509KeyStorageFlags.MachineKeySet is added,
   //but without X509KeyStorageFlags.MachineKeySet my application works in a console application (stress testing) but not in IIS (in a web application)
        return formatter.CreateSignature(hash);
    }

    SHA1CryptoServiceProvider Hash(string signatureBaseString)
    {
        var sha1 = new SHA1CryptoServiceProvider();

        var bytes = Encoding.ASCII.GetBytes(signatureBaseString);

        using (var crypto = new CryptoStream(Stream.Null, sha1, CryptoStreamMode.Write))
        {
            crypto.Write(bytes, 0, bytes.Length);
        }

        return sha1;
    }
}

编辑 1：新信息，似乎当我添加 X509KeyStorageFlags.MachineKeySet 时 _certificate.PrivateKey 会抛出异常，但是当我删除 X509KeyStorageFlags.MachineKeySet 时，IIS 会崩溃。 PS 我正在使用从 StartSSL 生成的证书

【问题讨论】：

标签： c# iis cryptography

【解决方案1】：

我将证书导入 LocalMachine Store（不是通过代码）然后在我的软件中我改变了

   var cert = new X509Certificate2();
   cert.Import(Resources.wildcard, "xxx", X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.Exportable);

到

        X509Store store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
        store.Open(OpenFlags.ReadOnly);
        foreach (X509Certificate2 certificate in store.Certificates)
        {
            if (certificate.SubjectName.Name != null && certs.SubjectName.Name.Contains("*.domain.xxx"))
            {
                cert = certificate;
            }
        }

这似乎比从文件加载证书更好，而且加载时也不会破坏 IIS

【讨论】：